[et_pb_section fb_built=”1″ _builder_version=”4.27.4″ _module_preset=”default” custom_padding=”||13px|||” global_colors_info=”{}”][et_pb_row _builder_version=”4.27.4″ _module_preset=”default” locked=”off” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”][et_pb_image src=”https:\/\/nationalcybersecuritysociety.org\/wp-content\/uploads\/2025\/09\/NCSS-3397-Bulletin-Header-Footer-Header-Graphic-1600×350-Compressed.png” title_text=”NCSS-3397-Bulletin-Header-Footer-Header Graphic 1600×350-Compressed” _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”][\/et_pb_image][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n
Published: March 14, 2025<\/em><\/p>\n [\/et_pb_text][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n Our new bulletin Cyber Threat Watch<\/em><\/strong> has been created to help small businesses stay up to date on the latest threats, news, and events affecting their business. The content has been curated to make cybersecurity easy and accessible for both technical and nontechnical readers.<\/span><\/p>\n [\/et_pb_text][et_pb_heading title=”Featured Cyber News \u2014 Cybersecurity Maturity Model Certification (CMMC)” _builder_version=”4.27.4″ _module_preset=”default” title_level=”h2″ title_font=”|600|||||||” title_text_color=”#00688E” global_colors_info=”{}”][\/et_pb_heading][et_pb_image src=”https:\/\/nationalcybersecuritysociety.org\/wp-content\/uploads\/2025\/09\/AdobeStock_925689897-scaled.jpeg” title_text=”Compliance. Hand holding a globe with network connecting data. In the context of digital technology, compliance with data regulations is essential for maintaining security and trust in global networks” _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”][\/et_pb_image][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n With the latest updates to the Cybersecurity Maturity Model Certification (CMMC) 2.0 in October 2024, compliance will soon be essential for any organization seeking to work with the U.S. Department of Defense (DoD). However, these cybersecurity standards are not limited to U.S. companies\u2014organizations worldwide that provide services to the DoD or are part of its supply chain must also meet the CMMC compliance requirements.<\/p>\n [\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row column_structure=”1_3,2_3″ _builder_version=”4.27.4″ _module_preset=”default” custom_padding=”0px||0px|||” global_colors_info=”{}”][et_pb_column type=”1_3″ _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”][et_pb_image src=”https:\/\/nationalcybersecuritysociety.org\/wp-content\/uploads\/2025\/09\/AdobeStock_654739539-scaled.jpeg” title_text=”United States Department of Defense headquarter logo” _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”][\/et_pb_image][\/et_pb_column][et_pb_column type=”2_3″ _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” header_3_text_color=”#00688E” global_colors_info=”{}”]<\/p>\n The CMMC 2.0 is a cybersecurity framework that ensures businesses working with the DoD have the necessary safeguards to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI)<\/a><\/span>.<\/p>\n [\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=”4.27.4″ _module_preset=”default” custom_padding=”0px||0px|||” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” custom_padding=”21px|||||” global_colors_info=”{}”]<\/p>\n FCI includes government contract-related data that isn\u2019t publicly available and requires basic security protections under FAR 52.204-21<\/a><\/span>. On the other hand, CUI is marked or identified as sensitive information requiring protection under the CUI program, which enforces stricter safeguards by following NIST SP 800-171<\/a><\/span> security controls\u2014this means that the government entity seeking private sector services or products is responsible for identifying what qualifies as CUI. Therefore, all CUI is FCI, but not all FCI is CUI. If your business\u2019s services or products may fall under CUI, ask the DoD program manager who is responsible for the contract to confirm what applies.<\/p>\n First introduced in 2021, it wasn\u2019t a contract requirement at that time. However, the Final Rule (October 2024) has made the CMMC compliance mandatory. This means that businesses will have to comply with the new requirements, once implemented, to secure new contracts, renew existing ones, or continue working with the DoD.<\/p>\n [\/et_pb_text][et_pb_image src=”https:\/\/nationalcybersecuritysociety.org\/wp-content\/uploads\/2025\/09\/AdobeStock_512641198-scaled.jpeg” title_text=”automatic coordinate measurement machine (CMM) during inspection automotive or motorcycle industrial part in quality control manufacturing process” _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”][\/et_pb_image][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” header_3_text_color=”#00688E” custom_css_free_form=”ol {|| list-style: none !important; || counter-reset: item; ||}||||ol li {|| counter-increment: item; || position: relative; || padding-left: 2em; \/* Adjust as needed for spacing *\/||}||||ol li::before {|| content: counter(item) %22.%22; || font-weight: bold; || position: absolute;|| left: 0; || width: 1.5em; || text-align: right;||}” global_colors_info=”{}”]<\/p>\n The latest update to CMMC 2.0 has simplified compliance while strengthening cybersecurity. Here\u2019s what\u2019s new:<\/span><\/p>\n The CMMC requirements apply to all businesses that work within the DoD supply chain, including the following:<\/span><\/p>\n The requirements of the CMMC 2.0 <\/span>Final Rule (32 CFR part 170) will roll out over three years, starting 60 days after the publication of the 48 CFR part 204 acquisition rule, which is expected by mid-2025. Here\u2019s what to expect:<\/span><\/p>\n Small businesses should take action now to avoid disruptions in their DoD contract eligibility. Follow the quick checklist below to align with the CMMC 2.0 Final Rule:<\/span>\u00a0<\/span><\/p>\n For small businesses offering professional services to the DoD, the CMMC compliance is critical. That\u2019s why these companies should start now to assess security gaps and prepare for upcoming requirements. By aligning with the upcoming CMMC 2.0 framework early, your business can remain competitive and secure DoD contracts in the future.\u00a0<\/span><\/p>\n The NCSS encourages businesses to adopt comprehensive security practices and stay informed about evolving cybersecurity requirements. We recommend you consider becoming an NCSS member to access a wide range of our services. For more information, visit our Small Business page<\/a><\/span>.<\/p>\n [\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=”4.27.4″ _module_preset=”default” locked=”off” global_colors_info=”{}” custom_margin=”54px|auto||auto||”][et_pb_column type=”4_4″ _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”][et_pb_divider _builder_version=”4.27.4″ _module_preset=”default” custom_margin=”||-2px|||” locked=”off” global_colors_info=”{}”][\/et_pb_divider][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” header_2_font=”|600|||||||” header_2_text_color=”#00688E” global_colors_info=”{}”]<\/p>\n https:\/\/www.federalregister.gov\/documents\/2024\/10\/15\/2024-22905\/cybersecurity-maturity-model-certification-cmmc-program<\/a><\/p>\n https:\/\/dodcio.defense.gov\/cmmc\/About\/<\/a><\/p>\n https:\/\/dodcio.defense.gov\/Portals\/0\/Documents\/CMMC\/ModelOverviewv2.pdf<\/a><\/p>\n https:\/\/isoo.blogs.archives.gov\/2020\/06\/19\/%E2%80%8Bfci-and-cui-what-is-the-difference\/<\/a><\/p>\n https:\/\/www.acquisition.gov\/far\/52.204-21<\/a><\/p>\n https:\/\/csrc.nist.gov\/pubs\/sp\/800\/171\/r3\/final<\/a><\/p>\n https:\/\/csrc.nist.gov\/news\/2021\/nist-publishes-sp-800-172<\/a><\/p>\n https:\/\/www.goodwinlaw.com\/en\/insights\/publications\/2024\/12\/alerts-otherindustries-the-cmmc-2-0-program-has-arrived<\/a><\/p>\n https:\/\/prescientsecurity.com\/blogs\/cmmc-final-ruling-and-key-information<\/a><\/p>\n https:\/\/www.nsf.org\/ca\/en\/knowledge-library\/proposed-new-rule-cmmc-program-assessment-mechanism-implementation-plan<\/a><\/p>\n https:\/\/carbidesecure.com\/resources\/cmmc-what-canadian-organizations-need-to-know<\/a><\/p>\n https:\/\/www.osibeyond.com\/blog\/cmmc-final-rule-timeline\/<\/a><\/p>\n https:\/\/ndisac.org\/dibscc\/cyberassist\/cybersecurity-maturity-model-certification\/level-1\/<\/a><\/p>\nWhat is CMMC 2.0?<\/h3>\n
Key Changes in the Latest Version<\/h3>\n
\n
– Level 1<\/a> (foundational; self-assessed): Basic security requirements for FCI<\/span>
– Level 2<\/a> (advanced; self-assessed, or assessed by the C3PAO\u2013Certified Third-Party Assessor Organization<\/em>): Protection of CUI, aligned with NIST SP 800-171<\/span>
– Level 3<\/a> (expert; assessed by the DIBCAC\u2013Defense Industrial Base Cybersecurity Assessment Center<\/em>): Highest level of security required for critical DoD systems, with additional requirements from NIST SP 800-172<\/a><\/span><\/li>\nWho Needs to Comply?<\/span><\/h3>\n
\n
Three-Year Implementation Plan: What Small Businesses Need to Know<\/h3>\n
\n
<\/span><\/strong>– CMMC Level 1 (self-assessment) and Level 2 (self-assessment) required for some contracts
<\/span>– Some contracts may require Level 2 (C3PAO assessment) audits, but it\u2019s not yet mandatory.<\/span><\/li>\n
<\/span><\/strong>– CMMC Level 2 (C3PAO assessment) required for many contracts handling CUI
<\/span>– DoD may require Level 3 (DIBCAC assessment) for high-risk contracts.<\/span><\/li>\n
<\/span><\/strong>– CMMC Level 2 (C3PAO assessment) mandatory for all contracts handling CUI
<\/span>– CMMC Level 3 (DIBCAC assessment) required for critical DoD programs<\/span><\/li>\n
<\/span><\/strong>– CMMC required for all new and renewed contracts\u2014no exceptions<\/span><\/li>\n<\/ul>\nHow to Prepare: A Quick Checklist<\/span><\/h3>\n
\n
Conclusion<\/h3>\n
\n
<\/ul>\n<\/li>\n<\/ul>\n
References<\/h2>\n